Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Populate the project
Add the target, scope note, three identities, one HTTP flow, one WebSocket frame, one finding, and one evidence item.
Inspect maps and timelines
Open HTTP flow, WebSocket frame, protocol map, and timeline views. Confirm request/response direction and timestamps link back to the same project.
Close and reopen
Exit cleanly, reopen Academy Lab, and verify no record became undefined or switched identities.
Back up before migration
Create a backup, record version and checksum, then exercise the supported schema migration. Keep the previous copy until validation completes.
Import a copied project
Import into a new project name, resolve duplicate IDs without overwriting the original, and verify evidence hashes after import.
Prove it before moving on.
Both original and imported projects contain the expected records and verified evidence hashes.
